What is CVE-2026-26218?

CVE-2026-26218 is a critical-severity vulnerability in Newbee-Ltd Newbee-Mall, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2026-02-12.

How severe is CVE-2026-26218?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Newbee-Ltd Newbee-Mall

CVE-2026-26218

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.

EPSS: 0.004 (29.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Newbee-ltd Newbee-mall — versions 1.0.0
Newbee-mall_project Newbee-mall

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

disclosure@vulncheck.com (issue-tracking, Exploit, Issue Tracking, Vendor Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-26218?: CVE-2026-26218 is a critical-severity vulnerability in Newbee-Ltd Newbee-Mall, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2026-02-12.
How severe is CVE-2026-26218?: Critical severity. CVSS v3 base score is 9.8 out of 10.